Finding · F-IAQ2-LOG-01

Customer portal not onboarded to the SIEM

ClosedLOG-01 · Security events are centrally logged and monitored 24x7Logging & MonitoringQ2 2026 Unified Program Review
Fraud indicator
Rating
No
High
Medium
Low

Requirement to validation

Requirement
ISO-A.8.15 · ISO-A.8.16 · RBI-CSF-NBFC-Annex-1-2 · RBI-ITGRCA-2023-7.6 · SOC2-CC7.2 · SOC2-CC7.3
mapped
Policy
Logging & Security Monitoring Standard
pol-logging
Control
LOG-01
Security events are centrally logged and monitored 24x7
Application
Amazon Web Services (ap-south-1) · Microsoft Entra ID · Meridian Customer Portal
mapped
Evidence · Q3
4 items
3 approved · 1 pending · 0 rejected
Test · Q3
Pass
TST-SOC2-LOG-01 · High confidence
Finding
F-IAQ2-LOG-01 · Medium
Closed
Action
Ananya Rao
REM-F-IAQ2-LOG-01 · Closed
Validation
Validated
as recorded
Observation
Raised 2026-06-20 in the Q2 2026 internal audit baseline. Authentication and payment-initiation events from the customer portal were not forwarded to the 24x7 SOC; coverage gap since the portal re-platforming in March.
Applications: Amazon Web Services (ap-south-1), Microsoft Entra ID, Meridian Customer Portal.
Potential risk
The control may not operate consistently, weakening reliance by auditors and the regulator.
Root cause
Log forwarding was not part of the re-platforming release checklist.
Agreed action plan

Remediate: customer portal not onboarded to the siem.

Management response: Management agreed and committed to remediate before the Q3 review.

Action
REM-F-IAQ2-LOG-01
Owner (FPR)
Ananya Rao
Target date
31 Jul 2026
Priority
Medium
Status
Closed
Validation
Validated · planned 26 Sep 2026

Evidence for this control (6)

Open list →
EvidenceTitleControlSource systemCollectedStatus
Q2-EV-024Amazon Web Services (ap-south-1) · ticket sample (Q2)LOG-01Amazon Web Services (ap-south-1)3 Jun 2026Rejected
Q2-EV-025Microsoft Entra ID · access review (Q2)LOG-01Microsoft Entra ID8 Jun 2026Rejected
RBI-REQ-018AWS: CloudTrail organisation trail enabledLOG-017 Oct 2026Under review
SOC2-REQ-028AWS: CloudTrail organisation trail enabledLOG-015 Oct 2026Accepted
SOC2-REQ-029Microsoft Entra ID: Entra diagnostic logs streamed to SIEMLOG-01Microsoft Entra ID4 Oct 2026Accepted
SOC2-REQ-030Meridian Customer Portal: Portal audit events received in last 24hLOG-01Meridian Customer Portal9 Oct 2026Accepted

Tests of this control (2)

Open list →
TestControlCycleTestedByResultConfidence
TST-SOC2-LOG-01LOG-01 · Security events are centrally logged and monitored 24x7Q3 2026 Unified Program Review3 Oct 2026Laura Bennett · Kestrel Assurance LLPPassHigh
TST-Q2-LOG-01LOG-01 · Security events are centrally logged and monitored 24x7Q2 2026 Unified Program Review18 Jun 2026Farah Khan, Vikram Mehta · Meridian Internal AuditFailHigh